Hashes

A hash allowlists an inline script by the cryptographic digest of its contents. Use a hash when the inline script is static and identical on every load, so no per-request server logic is needed.

How it works

Compute the SHA digest of the exact text between the <script> tags, base64 the result, and prefix it with the algorithm:

Content-Security-Policy: script-src 'sha256-cLuU6nVzrYJlxWFupKQaFxCRfDCWTUYVFNBBHtBGKPQ='

<script>console.log('static inline script');</script>

The browser hashes the inline script it finds and runs it only if the result is in the source list. sha256, sha384, and sha512 are all accepted.

The hash covers exact bytes

The digest is taken over the raw text content of the element, with no normalization. Any change invalidates it, including:

• A leading or trailing space or newline.
• A changed quote style or variable name.
• Re-indentation by your formatter.

Because of this, generate the hash from the exact bytes you ship, after any build step that might reformat the script. You can compute one with the inline-script hash generator.

Attributes are not part of the hash

The hash covers only the text between the tags, not the tag's attributes. An inline event handler like onclick="doThing()" is not covered by a normal script hash. Allowing those requires 'unsafe-hashes', which is a separate and weaker mechanism.

Nonce or hash?

• Hash: static inline scripts, static-site output, no server rendering.
• Nonce: dynamic pages that can emit a fresh value per response.

Hashes avoid per-request work but break the moment the script changes. Nonces tolerate changing script content but require server-side generation on every response. See nonces for that path.

Multiple inline scripts

Each distinct inline script needs its own hash. List them together:

script-src 'sha256-hashOfScriptA' 'sha256-hashOfScriptB'